Google Cloud Data Ingestion

Collection Method

Device Configuration

Pre-Requisite

1. Before you enable the log ingestion, please make sure the below permissions are added at the Org level.

   1. Predefined roles: roles/logging.configWriter

   2. Permissions: chroniclesm.gcpLogFlowFilters.update

2. Contact Adaptive MxDR onboarding engineer and obtain the one-time access code required to enable ingestion of your GCP telemetry.

3. To access the Google Security Operations, grant the following IAM roles to the account configuring the integration:

   • Chronicle Service Admin (roles/chroniclesm.admin): IAM role for performing all activities.

   • Chronicle Service Viewer (roles/chroniclesm.viewer): IAM role to only view the state of ingestion.

   • Security Center Admin Editor (roles/securitycenter.adminEditor): Required to enable the ingestion of Cloud Asset Metadata.

     To grant IAM roles using Google Cloud console, complete the following steps:

   • Log on to the Google Cloud Organization you want to connect to and navigate to the IAM screen using Products > IAM & Admin > IAM.

   • From the IAM screen, select the user and click Edit Member.

4. In the Edit Permissions screen, click Add Another Role and search for Chronicle to find the IAM roles.

   • Once you have assigned the roles, click Save.

5. To enable Cloud Asset Metadata, you must onboard the organization to the Security Command Center. See Overview of organization-level activation for more information.

To Enable Google Cloud data ingestion

Please follow below steps to configure direct ingestion from your Google Cloud organization into your Google Security Operations instance

1. Under Security Tab, navigate to Detections and Controls > Google SecOps.
   Select a project from the organization you wish to enable logging.

Open

2.Click the Manage organization ingestion settings button

Open

3. If you see the message Page not viewable for projects, select an organization, then click Select.

Open

4. Enter your one-time access code in the 1-time Chronicle access code field.

5. Check the box labeled I consent to the terms and conditions of Chronicle's usage of my Google Cloud data.

6. Click Connect Chronicle

Open

7. Navigate to the Global Ingestion Settings tab for the organization, confirm that the connected Chronicle instance ID (customer-xxxxxx) matches your SIEM tenant ID (https://acn-mdr-xxxxxx*.backstory.chronicle.security/)

8. Enable Google Cloud Logging, Cloud Asset Metadata & Security Command Center Premium Findings

Open

Identify logs using the Log Scoping Tool

To help you identify the logs that meet your security and compliance needs, you can use the log scoping tool. This tool provides an interactive table that lists valuable security-relevant logs across Google Cloud including Cloud Audit Logs, Access Transparency logs, network logs, and several platform logs.

You can use this to enable the logs for specific services and it will give you auto-generated log filter which you can use next step to configure Export filter settings.

You can follow https://cloud.google.com/architecture/security-log-analytics page for more information about log scoping tool.

Export Filter Settings

By default, your Cloud Audit logs (admin activity and system event) and Cloud DNS logs are sent to your Chronicle account. However, you can customize the export filter to include or exclude specific types of logs. The export filter is based on the Google logging query language.

To define a custom filter for your logs, complete the following steps:

1. Define your filter by creating a custom filter for your logs using the logging query language.
   The following documentation describes how to define this type of filter: https://cloud.google.com/logging/docs/view/logging-query-language .

2. Navigate to Google SecOps > EXPORT FILTER SETTINGS

3. Navigate to the Logs Explorer using the link provided on the EXPORT FILTER SETTINGS tab, copy your new query into the Query field and click Run Query to test it.

4. Please find below export filters for your reference to export all supported Google Cloud Services.

   log_id("cloudaudit.googleapis.com/activity") OR log_id("cloudaudit.googleapis.com/system_event") OR log_id("cloudaudit.googleapis.com/policy") OR log_id("cloudaudit.googleapis.com/access_transparency") OR log_id("compute.googleapis.com/nat_flows") OR log_id("dns.googleapis.com/dns_queries") OR log_id("compute.googleapis.com/firewall") OR log_id("ids.googleapis.com/threat") OR log_id("ids.googleapis.com/traffic") OR log_id("requests") OR log_id("cloudsql.googleapis.com/mysql-general.log") OR log_id("cloudsql.googleapis.com/mysql.err") OR log_id("cloudsql.googleapis.com/postgres.log") OR log_id("cloudsql.googleapis.com/sqlagent.out") OR log_id("cloudsql.googleapis.com/sqlserver.err") OR log_id("syslog") OR log_id("authlog") OR log_id("securelog") OR log_id("winevt.raw") OR log_id("windows_event_log") OR log_id("zeek_json_streaming_conn") OR log_id("zeek_json_streaming_dhcp") OR log_id("zeek_json_streaming_dns") OR log_id("zeek_json_streaming_http") OR log_id("zeek_json_streaming_ssh") OR log_id("zeek_json_streaming_ssl") OR log_id("events") OR log_id("stdout") OR log_id("stderr") OR log_id("audit_log") OR log_id("recaptchaenterprise.googleapis.com/assessment") OR log_id("recaptchaenterprise.googleapis.com/annotation") OR log_id("run.googleapis.com/stderr") OR log_id("run.googleapis.com/stdout") OR log_id("run.googleapis.com/requests") OR log_id("run.googleapis.com/varlog/system") OR log_id("networksecurity.googleapis.com/firewall_threat") OR logName =~ "^projects/[\w\-]+/logs/apigee\.googleapis\.com[\w\-]*$"

Service Specific Export filters

Google Cloud Asset Metadata Details

You can export your Google Cloud asset metadata from Cloud Asset Inventory to Google Security Operations. This asset metadata is drawn from your Cloud Asset Inventory and consists of information about your assets, resources, and identities including the following:

• Environment

• Location

• Zone

• Hardware models

• Access control relationships between resources and identities

The following types of Google Cloud asset metadata will be exported to your Google Security Operations instance:

• GCP_BIGQUERY_CONTEXT

• GCP_COMPUTE_CONTEXT

• GCP_IAM_CONTEXT

• GCP_IAM_ANALYSIS

• GCP_STORAGE_CONTEXT

• GCP_CLOUD_FUNCTIONS_CONTEXT

• GCP_SQL_CONTEXT

• GCP_NETWORK_CONNECTIVITY_CONTEXT

• GCP_RESOURCE_MANAGER_CONTEXT

Google Security Center Findings Details

The following types of Google Security Center Findings will be exported to your Google Security Operations instance:

• GCP_SECURITYCENTER_ERROR

• GCP_SECURITYCENTER_MISCONFIGURATION

• GCP_SECURITYCENTER_OBSERVATION

• GCP_SECURITYCENTER_THREAT

• GCP_SECURITYCENTER_UNSPECIFIED

• GCP_SECURITYCENTER_VULNERABILITY

• GCP_SECURITYCENTER_POSTURE_VIOLATION

• GCP_SECURITYCENTER_TOXIC_COMBINATION